Poisoned Dependency

Challenge Question

An internal billing service is only supposed to depend on packages published to the company's private registry. Somewhere in its dependency lockfile, one entry that should never resolve from the public internet is doing exactly that, and running install scripts while it's at it. Find the poisoned dependency.